CVE-2025-14451
Open Redirect in Solutions Ad Manager WordPress Plugin Allows Phishing
Publication date: 2025-12-13
Last updated on: 2025-12-13
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordpress | solutions_ad_manager | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-601 | The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability is an Open Redirect in the Solutions Ad Manager plugin for WordPress (versions up to 1.0.0). It occurs because the plugin does not properly validate the redirect URL provided via the 'sam-redirect-to' parameter. This allows unauthenticated attackers to redirect users to potentially malicious websites if they trick users into performing certain actions.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to redirect your users to malicious sites without authentication. This can lead to phishing attacks, malware distribution, or loss of user trust due to the redirection to harmful websites.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking for HTTP requests to your WordPress site that include the 'sam-redirect-to' parameter in the URL, which triggers the redirect function. Monitoring web server logs or using tools like curl or wget to test URLs with the 'sam-redirect-to' parameter can help identify if the plugin is redirecting without validation. For example, you can use the following command to test a redirect: curl -I 'https://yourwordpresssite.com/?sam-redirect-to=https://malicious.example.com&sam-post-id=123' and observe if it returns a 302 redirect to the external URL. Additionally, searching your site files for the presence of the vulnerable plugin version (up to 1.0.0) or the specific file 'class-solutions-ad-manager-public.php' can help confirm if the vulnerable code is present. [2, 3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include disabling or removing the Solutions Ad Manager plugin if it is version 1.0.0 or earlier, as these versions contain the open redirect vulnerability. If disabling the plugin is not feasible, restrict access to URLs containing the 'sam-redirect-to' parameter via web application firewall (WAF) rules or server-level filtering to block potentially malicious redirect attempts. Additionally, monitor and audit your site for suspicious redirect activity. Applying any available patches or updates from the plugin developer that address this vulnerability should be prioritized once released. [2, 3]